Kernel RCE in iOS/macOS with ICMP

#1

Post by dogecoinbase » Wed, Oct 31, 2018, 11:04 PM UTC

Kernel RCE in iOS/macOS with ICMP
lgtm.com

Re: Kernel RCE in iOS/macOS with ICMP

#2

Post by microcolonel » Wed, Oct 31, 2018, 11:33 PM UTC

Why do I need JavaScript localStorage to look at a blog post?

Edit: An indirect archive, because apparently archive.is does not allow localStorage access either. http://archive.is/yuIV5

Re: Kernel RCE in iOS/macOS with ICMP

#3

Post by saagarjha » Wed, Oct 31, 2018, 11:37 PM UTC

TL;DR: Heap buffer overflow in the network stack allowed for sending ICMP packets that would crash devices. Bug was marked as "RCE" because it's possible that it could be used for code execution, though the current PoC only causes a crash. Bug has been reported to Apple and fixed in iOS 12 and macOS Mojave 10.14. There's an excellent drawing by the author at the end of the author summarizing the exploit ;)

As an aside:

> Even on a Mac, XNU is highly non-trivial to build.

I find it to be an extremely sad state of affairs when it requires scouring the internet for a blog post from a Darwin engineer to build an outdated XNU :(

Re: Kernel RCE in iOS/macOS with ICMP

#4

Post by wepple » Wed, Oct 31, 2018, 11:57 PM UTC

Can someone explain to me, did I miss the description of the actual bug here? I get there’s a copy, but why is there an under-allocation to start with? Or is that alloc somehow attacker-controlled? Was part of the copy func args controllable? Or was this just an ad?

Re: Kernel RCE in iOS/macOS with ICMP

#5

Post by jerf » Wed, Oct 31, 2018, 11:58 PM UTC

The Ping of Death rides again!

Ok, yeah, not exactly the same, but humor me. It's a Halloween undead miracle!

Re: Kernel RCE in iOS/macOS with ICMP

#6

Post by 0x0 » Thu, Nov 01, 2018, 12:01 AM UTC

saagarjha wrote: post #3

TL;DR: Heap buffer overflow in the network stack allowed for sending ICMP packets that would crash devices. Bug was marked as "RCE" because it's possible that it could be used for code execution, though the current PoC only causes a crash. Bug has been reported to Apple and fixed in iOS 12 and macOS Mojave 10.14. There's an excellent drawing by the author at the end of the author summarizing the exploit ;) As an asid…

Apparently it was actually already fixed in ios 12.0 and macOS 10.14.0 but retroactively added to the security notes for those releases only just now.

Re: Kernel RCE in iOS/macOS with ICMP

#7

Post by nixpulvis » Thu, Nov 01, 2018, 12:08 AM UTC

saagarjha wrote: post #3

TL;DR: Heap buffer overflow in the network stack allowed for sending ICMP packets that would crash devices. Bug was marked as "RCE" because it's possible that it could be used for code execution, though the current PoC only causes a crash. Bug has been reported to Apple and fixed in iOS 12 and macOS Mojave 10.14. There's an excellent drawing by the author at the end of the author summarizing the exploit ;) As an asid…

and yet I always hear the argument, "but it's open source, just like Linux".

Re: Kernel RCE in iOS/macOS with ICMP

#8

Post by saagarjha » Thu, Nov 01, 2018, 12:11 AM UTC

0x0 wrote: post #6

saagarjha wrote: post #3

TL;DR: Heap buffer overflow in the network stack allowed for sending ICMP packets that would crash devices. Bug was marked as "RCE" because it's possible that it could be used for code execution, though the current PoC only causes a crash. Bug has been reported to Apple and fixed in iOS 12 and macOS Mojave 10.14. There's an excellent drawing by the author at the end of the author summarizing the exploit ;) As an asid…

Apparently it was actually already fixed in ios 12.0 and macOS 10.14.0 but retroactively added to the security notes for those releases only just now.

Thanks, updated.

Re: Kernel RCE in iOS/macOS with ICMP

#9

Post by [deleted] » Thu, Nov 01, 2018, 12:13 AM UTC

nixpulvis wrote: post #7

saagarjha wrote: post #3

TL;DR: Heap buffer overflow in the network stack allowed for sending ICMP packets that would crash devices. Bug was marked as "RCE" because it's possible that it could be used for code execution, though the current PoC only causes a crash. Bug has been reported to Apple and fixed in iOS 12 and macOS Mojave 10.14. There's an excellent drawing by the author at the end of the author summarizing the exploit ;) As an asid…

and yet I always hear the argument, "but it's open source, just like Linux".

[deleted]

Re: Kernel RCE in iOS/macOS with ICMP

#10

Post by derefr » Thu, Nov 01, 2018, 12:13 AM UTC

saagarjha wrote: post #3

TL;DR: Heap buffer overflow in the network stack allowed for sending ICMP packets that would crash devices. Bug was marked as "RCE" because it's possible that it could be used for code execution, though the current PoC only causes a crash. Bug has been reported to Apple and fixed in iOS 12 and macOS Mojave 10.14. There's an excellent drawing by the author at the end of the author summarizing the exploit ;) As an asid…

Presumably, internally to Apple, XNU is built mostly on build-servers. Maybe even the branches having CI build-on-push, and test machines able to PXE-boot directly to a given branch's tip build. In such a case, you'd never need XCode to successfully build a standalone XNU at all.